1. Overview & Scope
This Privacy Policy describes how Sytira ("Sytira", "we", "us", or "our") collects, uses, and discloses information when you use our website, customer support application, live chat widgets, APIs, and services (collectively, the "Platform").
By using Sytira, you understand that your information will be processed in accordance with this Privacy Policy and our Terms of Service.
2. Data Controller vs. Data Processor
When you create an account to use Sytira, we act as a Data Controller for your account profile and billing details. When you and your agents interact with your customers (end-users) through our inboxes, chat widgets, and WhatsApp channels, you act as the Data Controller and Sytira acts as a Data Processor processing conversation data on your behalf.
3. Information We Collect
We collect information in three primary categories:
- Account & Registration Data: Name, business email address, company name, encrypted password hash, and billing contact information.
- Customer Conversation Data: Messages, chat transcripts, attachments, audio voice notes, phone numbers (for WhatsApp), and email addresses collected via pre-chat forms or customer interactions.
- Technical & Telemetry Data: IP address, device type, browser user agent, operating system, timestamp of requests, and referral source.
4. How We Use Information
We use collected data solely for legitimate business purposes:
- To provide, operate, and maintain the Sytira messaging and ticketing platform.
- To route messages in real time between your team agents and your website visitors or WhatsApp contacts.
- To send critical system alerts, password reset emails, and conversation notifications.
- To generate aggregate, anonymized operational analytics (e.g., average first response time, resolution volume).
- To detect, prevent, and mitigate fraud, spam, and security vulnerabilities.
We do not sell, rent, or trade your personal data or your customers' conversation histories to third parties or advertisers.
5. Captain AI Privacy Policy
When Captain AI features (summarization, copilot rewrites, automated FAQ extraction) are utilized, customer messages are processed via enterprise API endpoints. Customer data is processed ephemerally and is never used to train, retrain, or improve third-party foundation models.
AI assistance is opt-in and can be fully disabled at the system level at any time by your workspace administrator.
6. Sub-processors & Cloud Infrastructure
Sytira partners with trusted cloud infrastructure providers that meet strict security and data protection certifications (SOC 2, ISO 27001, GDPR):
- Amazon Web Services (AWS) & Heroku: Secure cloud compute, database hosting, and automated backup infrastructure (EU and US hosting zones).
- Meta WhatsApp Cloud API: Encrypted messaging transport for official WhatsApp Business messaging.
- Transactional Email Gateways (e.g., SendGrid / Postmark / AWS SES): Reliable delivery of notification and password reset emails.
- Stripe: PCI-DSS Level 1 certified payment processing for subscription billing (Sytira does not store raw credit card numbers).
7. Data Retention & Erasure
We retain your account and customer messaging data for as long as your workspace account remains active. If you delete a conversation or contact, it is marked for immediate purging from active databases.
If you close your account, all associated conversation transcripts, customer profiles, and team inboxes are completely deleted from our production systems within 30 days.
8. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
9. Your GDPR & CCPA Rights
Depending on your location, you and your customers have specific statutory rights under data protection laws:
- Right of Access: Request a copy of all personal data held about you.
- Right to Rectification: Request correction of inaccurate or incomplete information.
- Right to Erasure ("Right to be Forgotten"): Request complete deletion of your personal data.
- Right to Data Portability: Export your customer records and conversation transcripts in standard machine-readable format (JSON / CSV).
- Right to Object & Restrict Processing: Restrict or object to specific processing operations.
To exercise any of these rights, contact our Data Protection team at privacy@sytira.com.
10. Security & Encryption Standards
We implement comprehensive technical and administrative security measures:
- Encryption in Transit: All HTTP and WebSocket traffic is encrypted using TLS 1.3 / HTTPS.
- Encryption at Rest: Databases, message archives, and media uploads are encrypted with AES-256.
- Authentication: Secure password hashing (Bcrypt), optional Two-Factor Authentication (2FA), and SAML Single Sign-On (SSO) for Enterprise accounts.
- Least Privilege Access: Production access is strictly limited to authorized engineers via encrypted multi-factor authentication.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our legal obligations or product capabilities. Significant modifications will be communicated via email or an in-app notice prior to taking effect.
13. Privacy Contact & DPO
For privacy inquiries, GDPR data requests, or compliance questions, please contact our Data Protection Officer: